ryanmcdonough moves to plug a chat-creation loophole

The problem was quiet but real. When someone created a new chat, the system took the project it was attached to on trust, without checking whether that user actually had any right to that project. In practice, any signed-in user could spin up chats inside other people's projects.

ryanmcdonough's fix makes the system confirm entitlement before writing anything: if you don't own or share access to the named project, the request is turned away as if the project simply doesn't exist - so the response never even reveals whether a given project is real. Owners and shared members see no change. It's a tight, single-purpose patch that reuses the existing access-check plumbing rather than bolting on new machinery. Worth noting: the proposal was closed without being merged, so this guard never actually landed.